---
id: CVE-2026-76054
title: >-
  Invocation of Process Using Visible Sensitive Information in Black Duck
  blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code
  within the scanned project's build to obtain the Black Duck API token via the
  ambient proce…
summary: >-
  Invocation of Process Using Visible Sensitive Information in Black Duck
  blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code
  within the scanned project's build to obtain the Black Duck API token via the
  ambient proce…
severity: none
cwe:
  - CWE-214
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76054'
references:
  - url: >-
      https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055
    label: disclosure@synopsys.com
  - url: 'https://pypi.org/project/blackduck-c-cpp/'
    label: disclosure@synopsys.com
tags:
  - nvd
epss: 0.00184
epssPercentile: 0.07322
ingestedAt: '2026-10-12T15:55:08.120Z'
---

## Overview

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.



Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.